Subject: [http-state] BNF notation differences, was: Comments on draft-ietf-httpstate-cookie-08.txt (1 - 4.1.2.)

From: Julian Reschke <[email-masked]>
Date: Wed, 14 Jul 2010 16:09:57 +0200

On 31.05.2010 18:25, Adam Barth wrote:
> ...
>> Copying the rfc1123-date grammar from draft-ietf-httpbis-p1-messaging-09
>> into an appendix would probably be the best solution as differences with
>> case-sensitivity and white space would then no longer be a source of
>> confusion. Otherwise there simply should be a reminder that the grammar
>> notation is different from RFC 2616 and care must be taken to apply the
>> right rules for imported symbols.
>
> I've add the following text near the use of 1123-date:
>
> [[
> sane-cookie-date  =<rfc1123-date, as defined in RFC 2616>
>                      ; Note that RFC 2616 uses a different grammatical notation
>                      ; than this document (which uses ABNF from RFC5234).
> ]]
>
> Hopefully that addresses your concerns.
> ...

The current ABNF is:

set-cookie-header = "Set-Cookie:" SP set-cookie-string
set-cookie-string = cookie-pair *( ";" SP cookie-av )
cookie-pair       = cookie-name "=" cookie-value
cookie-name       = token
cookie-value      = token
token             = <token, defined in [RFC 2616], Section 2.2>

cookie-av         = expires-av / max-age-av / domain-av /
                     path-av / secure-av / httponly-av /
                     extension-av
expires-av        = "Expires=" sane-cookie-date
sane-cookie-date  = <rfc1123-date, defined in [RFC 2616], Section 3.3.1>
                     ; Note that RFC 2616 uses a different grammatical
                     ; notation than this document (which uses ABNF
                     ; from [RFC5234]).
max-age-av        = "Max-Age=" 1*DIGIT
domain-av         = "Domain=" domain-value
domain-value      = <subdomain, defined in [RFC 1034], Section 3.5>
path-av           = "Path=" path-value
path-value        = <any CHAR except CTLs or ";">
secure-av         = "Secure"
httponly-av       = "HttpOnly"
extension-av      = <any CHAR except CTLs or ";">

So the comment was applied to sane-cookie-date, but it also applies to 
token. Furthermore, the ABNF for domain-value (RFC 1034) uses yet 
another syntax. So maybe it would be better to remove the comment again, 
and just to add a prose warning that these three productions inherited 
from other specs are defined in different variants of ABNF.

Also, re:

   <any CHAR except CTLs or ";">

I think it would be good to avoid prose productions. In this case, an 
alternative would be:

   0x20-3A / 0x3C-7E
   ; any CHAR except CTLs or ";"

Best regards, Julian

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Wed, 14 Jul 2010 16:19:10 +0200

>from other specs are defined in different variants of ABNF.

The reference to RFC 1034 is most likely in error, the subdomain rule
there prohibits for instance values that start with a digit; see e.g.
draft-iab-idn-encoding for some of the history around that. 
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/

---

From: Adam Barth <[email-masked]>
Date: Wed, 14 Jul 2010 10:16:43 -0700

> draft-iab-idn-encoding for some of the history around that.

Is there another reference you'd prefer?

Adam

---

From: Adam Barth <[email-masked]>
Date: Wed, 14 Jul 2010 10:21:15 -0700

On Wed, Jul 14, 2010 at 7:09 AM, Julian Reschke <[email-masked]> wrote:
>> notation
> token. Furthermore, the ABNF for domain-value (RFC 1034) uses yet another
> syntax. So maybe it would be better to remove the comment again, and just to
> add a prose warning that these three productions inherited from other specs
> are defined in different variants of ABNF.

Done.

>  ; any CHAR except CTLs or ";"

I've left this as is.  The RFC Editor can get on my case if he or she
doesn't like this formulation.

Adam

---

From: Julian Reschke <[email-masked]>
Date: Thu, 15 Jul 2010 14:28:48 +0200

> doesn't like this formulation.

RFC 5234 says that the prose form is to be used as "last resort" (see 
<http://greenbytes.de/tech/webdav/rfc5234.html#rfc.section.4>). Meaning: 
don't use it unless you really really have to.

Best regards, Julian

---

From: Julian Reschke <[email-masked]>
Date: Fri, 16 Jul 2010 12:08:50 +0200

On 14.07.2010 19:16, Adam Barth wrote:
> On Wed, Jul 14, 2010 at 7:19 AM, Bjoern Hoehrmann<[email-masked]>  wrote:
>> * Julian Reschke wrote:

What's the actual constraint you want the ABNF to express? Shouldn't 
this be very similar to the value of the HTTP host header field, thus 
<http://tools.ietf.org/html/rfc3986#section-3.2.2>?

Best regards, Julian